Claude 19e1ee015f 🔒 SECURITY: Fix critical SQL injection and CORS vulnerabilities ... CRITICAL FIXES: - Fixed SQL injection vulnerability in document deletion endpoint - Changed PostgreSQL-style (%s) to SQLite-style (?) placeholders - Updated JSON operator from metadata->>'filename' to json_extract() - Affected lines: server.py:666, 679 - Fixed CORS security risk (allow_origins=["*"]) - Restricted to configurable whitelist via ALLOWED_ORIGINS env var - Default: localhost:5173,8051 for development - Production: Set to specific domains only - Added rate limiting to prevent DoS attacks - Implemented slowapi for per-IP rate limiting - Chat endpoint: 20 requests/minute per IP - Prevents resource exhaustion Security impact: CRITICAL → SECURE Files: mcp_server/server.py, .env.example		2025-11-04 19:15:54 +00:00
..
tools	first commit	2025-10-22 13:29:28 -05:00
__init__.py	first commit	2025-10-22 13:29:28 -05:00
auth.py	Add simple email/password authentication to frontend	2025-10-30 21:07:53 -05:00
server.py	🔒 SECURITY: Fix critical SQL injection and CORS vulnerabilities	2025-11-04 19:15:54 +00:00